Blog | G5 Cyber Security

Say Hello to the file-identify category

This week we are introducing a new rule category into the VRT rule set, named “file-identify.rules” The purpose of this category is to standardize the structure of rules that set a flowbit and to enhance detection by looking into file data. The changes will occur in two stages: Stage 1. The creation of a series of. rules that detect the “magic” in files, probably around 70 to start, with more being added as time passes and needs arise.”]

Source: https://blog.talosintelligence.com/2011/11/say-hello-to-file-identify-category.html

Exit mobile version